OSINT

Build threat actor profiles by collecting OSINT from vendor reports, paste sites, dark web forums, social media, and code repos, correlating indicators, mapping adversary infrastructure with tools…

mukul975/Anthropic-Cybersecurity-Skills

Deploy MISP via Docker and configure feeds from sources like abuse.ch, AlienVault OTX, and CIRCL to aggregate, correlate, and distribute threat intelligence, including automated feed synchronization…

mukul975/Anthropic-Cybersecurity-Skills

Builds automated threat intelligence feed integration pipelines connecting STIX/TAXII feeds, open-source threat intel, and commercial TI platforms into SIEM and security tools for real-time IOC…

mukul975/Anthropic-Cybersecurity-Skills

Collects and synthesizes open-source intelligence (OSINT) about threat actors, malicious infrastructure, and attack campaigns using publicly available data sources, passive reconnaissance tools, and…

mukul975/Anthropic-Cybersecurity-Skills

Evaluates and selects Threat Intelligence Platform (TIP) products based on organizational requirements including feed integration capability, STIX/TAXII support, workflow automation, analyst…

mukul975/Anthropic-Cybersecurity-Skills

Implements external attack surface management (EASM) using Shodan, Censys, and ProjectDiscovery tools (subfinder, httpx, nuclei) for asset discovery, subdomain enumeration, service fingerprinting…

mukul975/Anthropic-Cybersecurity-Skills

Create, validate, and share STIX 2.1 threat intelligence objects (indicators, malware, campaigns, relationships, bundles) using the stix2 Python library, and publish them over TAXII 2.1.

mukul975/Anthropic-Cybersecurity-Skills

Build out a full CTI program around the six-phase threat intelligence lifecycle (direction, collection, processing, analysis, dissemination, feedback), including defining intelligence requirements…

mukul975/Anthropic-Cybersecurity-Skills

Use AI/LLM-based reasoning with Sherlock, theHarvester, and SpiderFoot to correlate OSINT findings—usernames, emails, social profiles, domain records, breach databases, and dark-web mentions—into…

mukul975/Anthropic-Cybersecurity-Skills

Automates Indicator of Compromise (IOC) enrichment by orchestrating lookups across VirusTotal, AbuseIPDB, Shodan, MISP, and other intelligence sources to provide contextual scoring and disposition…

mukul975/Anthropic-Cybersecurity-Skills

Processes STIX 2.1 threat intelligence bundles delivered via TAXII 2.1 servers, normalizing objects into platform-native schemas and routing them to appropriate consuming systems.

mukul975/Anthropic-Cybersecurity-Skills

A skill your agent uses when mapping a target's external attack surface or gathering OSINT — subdomain enumeration, attack-surface mapping (httpx/katana/JS secrets), subdomain takeover…

hypnguyen1209/offensive-claude

Guidance for Azure Firewall — managed cloud-native L3-L7 stateful network firewall for centralised egress, east-west, and ingress control.

vinayaklatthe/microsoft-security-skills

Sparse-clue OSINT investigation methodology for extracting overlooked leads, connecting fragmented evidence, and testing explanations across sources.

affaan-m/ECC

Query a MISP (Malware Information Sharing Platform) instance via PyMISP to compute event statistics, IOC type breakdowns, threat actor galaxy clusters, and tag trends, and generate threat landscape…

mukul975/Anthropic-Cybersecurity-Skills

Detects early-stage ransomware indicators in network traffic before encryption begins, including initial access broker activity, command-and-control beaconing, credential harvesting, reconnaissance…

mukul975/Anthropic-Cybersecurity-Skills

Systematically collects, categorizes, and distributes indicators of compromise (IOCs) during and after security incidents to enable detection, blocking, and threat intelligence sharing.

mukul975/Anthropic-Cybersecurity-Skills

Generates structured cyber threat intelligence reports at strategic, operational, and tactical levels tailored to specific audiences including executives, security operations teams, and technical…

mukul975/Anthropic-Cybersecurity-Skills

Manages the end-to-end cyber threat intelligence lifecycle from planning and direction through collection, processing, analysis, dissemination, and feedback to ensure intelligence products meet…

mukul975/Anthropic-Cybersecurity-Skills

Analyze IP address reputation using the Shodan API to identify open ports, running services, known vulnerabilities, and hosting context for threat intelligence enrichment and incident triage.

mukul975/Anthropic-Cybersecurity-Skills

Enrich malware file hashes (MD5, SHA-1, SHA-256) using the VirusTotal API v3 to retrieve multi-engine detection rates, sandbox behavioral analysis, YARA rule matches, related indicators, and…

mukul975/Anthropic-Cybersecurity-Skills

Automate OSINT collection with the SpiderFoot REST API and CLI (sf.py/spiderfoot-cli) across 200+ modules, selecting scan modes (footprint, investigate, passive) and parsing results for domains…

mukul975/Anthropic-Cybersecurity-Skills

Uses PyMISP (the official MISP REST API library) to create events with structured IOCs (IPs, domains, hashes, URLs), enrich them with MITRE ATT&CK tags and galaxy clusters, manage sharing groups and…

mukul975/Anthropic-Cybersecurity-Skills

Find and remove authorized personal information exposures from data brokers and people-search sites with a consent-gated local workflow.

CoWork-OS/CoWork-OS

Export your entire Prospeo people search to CSV. An agent skill from growthenginenowoslawski/coldoutboundskills.

growthenginenowoslawski/coldoutboundskills

Perform OSINT and external reconnaissance for approved targets.

SpecterOps/skills

Detect transcription factor binding footprints in ATAC-seq using TOBIAS, HINT-ATAC, Wellington, or scprinter.

GPTomics/bioSkills

Expert malware analyst specializing in defensive malware research, threat intelligence, and incident response.

aiskillstore/marketplace

Passive recon of subdomains, SSL certs, WHOIS, and DNS. An agent skill from Luciole-Studio/Misaka-Agent.

Luciole-Studio/Misaka-Agent

Gather and correlate open source intelligence from public sources for authorized investigations, threat intelligence, and attack surface assessment.

briiirussell/cybersecurity-skills

Analyze TF motif accessibility variability across samples or single cells using chromVAR.

GPTomics/bioSkills

Zero friction. An agent skill from HKUDS/CLI-Anything.

HKUDS/CLI-Anything

Two-phase Apollo.io prospecting: free People Search to discover ICP-matching leads, then selective enrichment to reveal emails/phones (credits per contact).

gooseworks-ai/goose-skills

Shodan lookups: internet-connected devices, ports, services. An agent skill from taracodlabs/aiden.

taracodlabs/aiden

External recon and OSINT pipeline - subdomain enum, live host discovery, URL crawl, JS analysis, nuclei scan.

Encod3d-Sec/TORCH

Automates the end-to-end detection engineering workflow in Google SecOps using MCP tools.

google/skills

Orchestrates the end-to-end bulk ATAC-seq pipeline from FASTQ to differential accessibility and TF footprints, chaining Nextera-aware fastp QC, Bowtie2 alignment, chrM removal, dedup, a single Tn5…

GPTomics/bioSkills

Conduct proactive, hypothesis-driven threat hunting. An agent skill from dandye/ai-runbooks.

dandye/ai-runbooks

Open-source intelligence gathering - company repository enumeration, secret scanning, git history analysis, employee footprint, and code exposure discovery.

transilienceai/communitytools

OSINT-based technology stack identification. An agent skill from transilienceai/communitytools.

transilienceai/communitytools

Social media monitoring, narrative tracking, and OSINT. An agent skill from jamditis/claude-skills-journalism.

jamditis/claude-skills-journalism

Multi-source threat intelligence and vulnerability lookup. An agent skill from ptn1411/skill.

ptn1411/skill

Monitors dark web forums, marketplaces, paste sites, and ransomware leak sites for mentions of organizational assets, leaked credentials, threatened attacks, and threat actor communications to…

mukul975/Anthropic-Cybersecurity-Skills

Security engineering router for penetration testing, code auditing, red/blue/purple team operations, threat intelligence, and vulnerability research.

telagod/code-abyss

Triage ASM/recon output for ownership before testing — separate the target's real assets from namespace-collision noise.

elementalsouls/Claude-BugHunter

A skill your agent uses when asked to analyze, investigate, or report on honeypot server security.

SCStelz/security-investigator

Turn a published threat-intelligence article into a tested threat-hunting campaign.

SCStelz/security-investigator

Build and maintain a scored Total Addressable Market (TAM) using Apollo Company Search.

gooseworks-ai/goose-skills